wip: use tmpfiles.d for a volatile home directory

assets/pam.d/kiosk

 auth           required        pam_unix.so nullok
+
 account        required        pam_unix.so
+
 session        required        pam_unix.so
+session        required        pam_loginuid.so
 session        required        pam_systemd.so class=user type=wayland

assets/systemd/system/de.h-da.fbi.kiosk.service

@@ -24,20 +24,8 @@ PAMName=kiosk
 
 User=kiosk
 Group=kiosk
-RemoveIPC=yes
-PrivateTmp=yes
 NoNewPrivileges=yes
 RestrictSUIDSGID=yes
-ProtectSystem=strict
-ProtectHome=no
-
-RuntimeDirectory=kiosk
-StateDirectory=kiosk
-CacheDirectory=kiosk
-LogsDirectory=kisok
-ConfigurationDirectory=kiosk
-TemporaryFileSystem=/tmp/.X11-unix/:mode=1777
-TemporaryFileSystem=/run/kiosk/home/:mode=0700
 
 [Install]
 Alias=display-manager.service

assets/tmpfiles.d/kiosk.conf

+#Type | Path       | Mode | User  | Group | Age | Argument...
+d       /run/kiosk   0700   kiosk   kiosk   0     -

bootc/Containerfile

@@ -67,6 +67,8 @@ COPY --chmod=0644 assets/pam.d/kiosk /usr/lib/pam.d/kiosk
 
 COPY --chmod=0644 assets/sysusers.d/kiosk.conf /usr/lib/sysusers.d/kiosk.conf
 
+COPY --chmod=0644 assets/tmpfiles.d/kiosk.conf /usr/lib/tmpfiles.d/kiosk.conf
+
 COPY --chmod=0644 \
  assets/plymouth/h-da/h-da.plymouth \
  assets/plymouth/h-da/h-da.script \

crates/compositor/src/main.rs

+use std::env::home_dir;
+use std::fs::{create_dir, OpenOptions};
+use std::io::ErrorKind;
 use calloop::signals::Signal::{SIGINT, SIGQUIT, SIGTERM};
 use calloop::signals::Signals;
 use clap::{Args, Parser};
@@ -53,6 +56,18 @@ struct Cli {
 }
 
 fn main() {
+    let home_dir_path = home_dir().expect("Home directory unknown"); 
+    if let Err(error) = create_dir(&home_dir_path) {
+        if error.kind() != ErrorKind::AlreadyExists {
+            Err::<(),_>(error).expect("Could not create home directory");
+        }
+    }
+    let home_dir = OpenOptions::new()
+        .read(true)
+        .open(home_dir_path)
+        .expect("Home directory not found");
+    home_dir.lock().expect("Failed to lock home directory");
+
     // Initialize the signals at the very beginning so that every thread will inherit the same
     // signal mask.
     let signal_source = Signals::new(&[SIGINT, SIGTERM, SIGQUIT]).expect("Failed to create signal source.");

rust-toolchain.toml

 [toolchain]
-channel = "stable"
+# TODO: Change to stable as soon as 1.87.0 has been released.
+channel = "nightly"